通过扇区读取文件内容

通过网络资料，自己再修改了一些，在VS2005上编译通过，正常运行！

代码如下（注意包含头文件和定义）：

==============================================================================

//!start

#include "stdafx.h"

#define WINVER 0x0501
#define _WIN32_WINNT 0x0501
#include<stdio.h>
#include <iostream>
#include <windows.h>
#include <tchar.h>
#include <Winioctl.h>




typedef /*__success(return >= 0)*/ LONG NTSTATUS;
typedef NTSTATUS *PNTSTATUS;


#define STATUS_SUCCESS   ((NTSTATUS)0x00000000L)


typedef struct _IO_STATUS_BLOCK {
union {
NTSTATUS Status;
PVOID    Pointer;
};
ULONG_PTR Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;




typedef enum _ATTRIBUTE_TYPE{
AttributeStandardInformation = 0x10,
AttributeAttributeList = 0x20,
AttributeFileName = 0x30,
AttributeObjectId = 0x40,
AttributeSecurityDescriptor = 0x50,
AttributeVolumeName = 0x60,
AttributeVolumeInformation = 0x70,
AttributeData = 0x80,
AttributeIndexRoot = 0x90,
AttributeIndexAllocation = 0xA0,
AttributeBitmap = 0xB0,
AttributeReparsePoint = 0xC0,
AttributeEAInformation = 0xD0,
AttributeEA = 0xE0,
AttributePropertySet = 0xF0,
AttributeLoggedUtilityStream = 0x100,
AttributeTerminate=-1
} ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE;




typedef struct _NTFS_RECORD_HEADER{
ULONG Type;
USHORT UsaOffset;
USHORT UsaCount;
USN Usn;
} NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER;


typedef struct _FILE_RECORD_HEADER{
NTFS_RECORD_HEADER Header;
USHORT SequenceNumber;
USHORT LinkCount;
USHORT AttributesOffset;
USHORT Flags;               // 0x0001 = InUse, 0x0002 = Directory
ULONG BytesInUse;
ULONG BytesAllocated;
ULONGLONG BaseFileRecord;
USHORT NextAttributeNumber;
} FILE_RECORD_HEADER, *PFILE_RECORD_HEADER;


typedef struct _ATTRIBUTE{
ATTRIBUTE_TYPE AttributeType;
ULONG Length;
BOOLEAN Nonresident;
UCHAR NameLength;
USHORT NameOffset;
USHORT Flags;               // 0x0001 = Compressed
USHORT AttributeNumber;
} ATTRIBUTE, *PATTRIBUTE;


typedef struct _RESIDENT_ATTRIBUTE{
ATTRIBUTE Attribute;
ULONG ValueLength;
USHORT ValueOffset;
USHORT Flags;               // 0x0001 = Indexed
} RESIDENT_ATTRIBUTE, *PRESIDENT_ATTRIBUTE;


typedef struct _NONRESIDENT_ATTRIBUTE{
ATTRIBUTE Attribute;
ULONGLONG LowVcn;
ULONGLONG HighVcn;
USHORT RunArrayOffset;
UCHAR CompressionUnit;
UCHAR AlignmentOrReserved[5];
ULONGLONG AllocatedSize;
ULONGLONG DataSize;
ULONGLONG InitializedSize;
ULONGLONG CompressedSize;    // Only when compressed
} NONRESIDENT_ATTRIBUTE, *PNONRESIDENT_ATTRIBUTE;


typedef NTSTATUS (__stdcall
 *TNtQueryInformationFile)(
 IN HANDLE FileHandle,
 PIO_STATUS_BLOCK IoStatusBlock,
 PVOID FileInformation,
 ULONG FileInformationLength,
 ULONG FileInformationClass
 );


#define ReadResidentAttribute(Attribute) (void*)((ULONG_PTR)(Attribute)+((PRESIDENT_ATTRIBUTE)(Attribute))->ValueOffset)


PATTRIBUTE GetNextAttribute(PFILE_RECORD_HEADER FileRecord,ATTRIBUTE_TYPE AttributeType,PATTRIBUTE CurrentPosition)
{
PATTRIBUTE Attribute;
for(Attribute=CurrentPosition?(PATTRIBUTE)((ULONG_PTR)CurrentPosition+CurrentPosition->Length):(PATTRIBUTE)((ULONG_PTR)FileRecord+FileRecord->AttributesOffset);Attribute->AttributeType!=-1&&Attribute->AttributeType!=0;Attribute=(PATTRIBUTE)((ULONG_PTR)Attribute+Attribute->Length))
if(Attribute->AttributeType==AttributeType)
return Attribute;
return 0;
}


TNtQueryInformationFile NtQueryInformationFile;
int copyfile(wchar_t*Destination,wchar_t*Source)
{
HANDLE hFile,hNewFile,hVolume;STARTING_VCN_INPUT_BUFFER inbuf;RETRIEVAL_POINTERS_BUFFER*outbuf;ULONG len,c;wchar_t RootPath[4]=L"C:\\",VolumeName[]=L"\\\\.\\C:";
LARGE_INTEGER Offset,FileId;LARGE_INTEGER LastVcn,FileSize;unsigned __int64 C;int Result=0,r;SIZE_T i;long offlong;
DWORD SectorsPerCluster,BytesPerSector,FreeClusters,TotalClusters,ClusterSize,Err;void*Buffer;IO_STATUS_BLOCK iosb;
NTFS_VOLUME_DATA_BUFFER NtfsData;PNTFS_FILE_RECORD_OUTPUT_BUFFER FileRec;
i=wcscspn(Source,L":");
RootPath[0]=Source[i-1];
VolumeName[4]=Source[i-1];
if(!GetDiskFreeSpaceW(RootPath,&SectorsPerCluster,&BytesPerSector,&FreeClusters,&TotalClusters))return 0;
ClusterSize=SectorsPerCluster*BytesPerSector;
Buffer=VirtualAllocEx((HANDLE)-1,0,ClusterSize,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);;
hFile=CreateFileW(Source,GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,0,OPEN_EXISTING,0,0);
if(hFile!=INVALID_HANDLE_VALUE)
{
FlushFileBuffers(hFile);
CloseHandle(hFile);
}
hFile=CreateFileW(Source,FILE_READ_ATTRIBUTES,FILE_SHARE_READ|FILE_SHARE_WRITE,0,OPEN_EXISTING,0,0);
if(hFile!=INVALID_HANDLE_VALUE)
{
outbuf=(PRETRIEVAL_POINTERS_BUFFER)VirtualAllocEx((HANDLE)-1,0,4096,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);
if(outbuf)
{
hVolume=CreateFileW(VolumeName,GENERIC_READ,FILE_SHARE_READ|FILE_SHARE_WRITE,0,OPEN_EXISTING,FILE_FLAG_NO_BUFFERING,0);
if(hVolume!=INVALID_HANDLE_VALUE)
{
hNewFile=CreateFileW(Destination,GENERIC_WRITE,FILE_SHARE_READ,0,CREATE_ALWAYS,0x80 | FILE_FLAG_WRITE_THROUGH,0);
if(hNewFile!=INVALID_HANDLE_VALUE)
{
GetFileSizeEx(hFile,&FileSize);
SetFilePointer(hNewFile,FileSize.LowPart,&FileSize.HighPart,0);
SetEndOfFile(hNewFile);
offlong=0;
SetFilePointer(hNewFile,0,&offlong,0);
inbuf.StartingVcn.QuadPart=0;
do
{
r=DeviceIoControl(hFile,FSCTL_GET_RETRIEVAL_POINTERS,&inbuf,sizeof(STARTING_VCN_INPUT_BUFFER),outbuf,4096,&len,0);
if(r)Err=0;else Err=GetLastError();
if(r||Err==ERROR_MORE_DATA||Err==NO_ERROR)
{
for(c=0,LastVcn=outbuf->StartingVcn;c<outbuf->ExtentCount;LastVcn=outbuf->Extents[c].NextVcn,c++)
{
Offset.QuadPart=outbuf->Extents[c].Lcn.QuadPart*ClusterSize;
SetFilePointer(hVolume,Offset.LowPart,&Offset.HighPart,0);
for(C=0;C<outbuf->Extents[c].NextVcn.QuadPart-LastVcn.QuadPart;C++)
{
ReadFile(hVolume,Buffer,ClusterSize,&len,0);
WriteFile(hNewFile,Buffer,len,&len,0);
}
}


}
if(Err==ERROR_MORE_DATA)inbuf.StartingVcn=LastVcn;else break;
}while(1);
if(Err==ERROR_HANDLE_EOF&&inbuf.StartingVcn.QuadPart==0)
{
if(NtQueryInformationFile(hFile,&iosb,&FileId,sizeof(LARGE_INTEGER),6)==0)
{
r=DeviceIoControl(hVolume,FSCTL_GET_NTFS_VOLUME_DATA,0,0,&NtfsData,sizeof(NTFS_VOLUME_DATA_BUFFER),&len,0);
if(r)
{
len=sizeof (NTFS_FILE_RECORD_OUTPUT_BUFFER)+ NtfsData.BytesPerFileRecordSegment- 1;
FileRec=(PNTFS_FILE_RECORD_OUTPUT_BUFFER)VirtualAllocEx((HANDLE)-1,0,len,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);
if(FileRec)
{
r=DeviceIoControl(hVolume,FSCTL_GET_NTFS_FILE_RECORD,&FileId,sizeof(LARGE_INTEGER),FileRec,len,&len,0);
if(r)
{
Result=WriteFile(hNewFile,ReadResidentAttribute(GetNextAttribute((PFILE_RECORD_HEADER)FileRec->FileRecordBuffer,AttributeData,0)),FileSize.LowPart,&len,0);
}
VirtualFreeEx((HANDLE)-1,FileRec,0,MEM_RELEASE);
}
}
}
}
if(r||Err==0)Result=1;
SetFilePointer(hNewFile,FileSize.LowPart,&FileSize.HighPart,0);
SetEndOfFile(hNewFile);
CloseHandle(hNewFile);
}
CloseHandle(hVolume);
}
CloseHandle(hFile);
}
VirtualFreeEx((HANDLE)-1,outbuf,0,MEM_RELEASE);
}
VirtualFreeEx((HANDLE)-1,Buffer,0,MEM_RELEASE);
return Result;
}


int _tmain(int argc, _TCHAR* argv[])
{
//static wchar_t src[255];
//wscanf(L"%s",src);
NtQueryInformationFile=(TNtQueryInformationFile)GetProcAddress(GetModuleHandleW(L"ntdll.dll"),"NtQueryInformationFile");
if(copyfile(L"I:\\dest.txt", L"I:\\src.txt"))
printf("ok");else printf("........");
getchar();
return 0;
}

//!end

=========================================================================================